Alerting
Highlighted

How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

Can someone please help me finish an alert I am trying to do below? I would like to set the alert to notify me once the count reaches 10k and then send me a list of the top 10 SRCIPs. However, when I put in the search count > 10000, it removed the srcip entries.

Here is my search string so far.

sourcetype="cisco:asa" action=blocked | stats count by src_ip, dest_ip, dest_port  | sort - by count | rename src_ip as Src, dest_ip as Dest, dest_port as Port | addcoltotals
0 Karma
Highlighted

Re: How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

Hi,

you could just set the number of results in the alert triggers wizard to 10000 events?

http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Defineper-resultalerts

then just use something like

index = _internal | stats count by source | top limit=5 source

so you would have

my_awesome_search | top limit=10 Src

Cheers

0 Karma
Highlighted

Re: How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

Thank you.

But that the problem. When I put the 10k in the alert trigger, it's just like putting it in the search string where it then removed all other records. I would also need the top 5 plus a line totalling the OTHER count as well.

0 Karma
Highlighted

Re: How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

I would also need the top 10 plus a line totaling the OTHER count as well.

0 Karma
Highlighted

Re: How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

Use the custom condition in your alert :

where count > 1000
0 Karma
Highlighted

Re: How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

thank you, that worked on the alert. All I need now is to report the top x while keeping an "Other" count at the bottom.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.